kixparadigm-en@1.2.13: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kixparadigm-en@1.2.13: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-lib.js --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-lib.js --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preset/plugins/kix-guards.jsView file

94const { join } = require('node:path') L95: const { execFile } = require('node:child_process') L96: const { promisify } = require('node:util')

High

Child Process

Package source references child process execution.

preset/plugins/kix-guards.jsView on unpkg · L94

•matchType = previous_version_dangerous_delta matchedPackage = kixparadigm-en@1.2.11 matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.2.11 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

preset/plugins/kix-guards.jsView on unpkg

bin/kixparadigm-en.jsView file

3// kixparadigm-en CLI — English edition, installs the kixparadigm-en preset L4: require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm-en.jsView on unpkg · L3

preset/plugins/kix-guards.test.js#virtual:string-array:round1View file

167check("pwsh: cp 外部 → 控制平面 → deny（v8 目标命中）", await dispatch("pwsh", { command: `cp /tmp/settings.yaml ${HOME}/.dsh/settings.yaml` }), true) L168: check(`pwsh: curl -o ${HOME}/.dsh/settings.yaml URL → deny（v8 下载目标）`, await dispatch("pwsh", { command: `curl -o ${HOME}/.dsh/settings.yaml https://example.com/x` }), true) L169: check(`pwsh: curl -o /tmp/x URL → allow（v8 下载目标非控制平面）`, await dispatch("pwsh", { command: "curl -o /tmp/x https://example.com/x" }), false) ... L176: // ══ 4. run_code 代码体受限能力（v3 补 fs 直写）════════════════════════ L177: check("run_code: import(\"node:child_process\") → deny", await dispatch("run_code", { code: "const cp = await import(\"node:child_process\"); return 1" }), true) L178: check("run_code: fetch( 网络 → deny", await dispatch("run_code", { code: "const r = aw

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

preset/plugins/kix-guards.test.js#virtual:string-array:round1View on unpkg · L167

preset/skills/kixpower/tests/run-contract-regression.ps1View file

•path = [redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 56539 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

•path = [redacted]-contract-regression.ps1 kind = build_helper sizeBytes = 56539 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 12-52json

12 "ai-agent",

13 "deepseek-harness",

14 "dsh",

15 "agent-preset",

16 "multi-agent",

17 "coding-agent",

18 "english"

19 ],

20 "bin": {

21 "kixparadigm-en": "bin/kixparadigm-en.js"

22 },

23 "files": [

24 "bin/",

25 "scripts/",

26 "preset/",

27 "bridge/",

28 "README.md",

29 "LICENSE"

30 ],

31 "scripts": {

32 "postinstall": "node scripts/install-lib.js --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "test:installer": "node --test scripts/install-lib.test.js",

34 "test:consistency": "node scripts/check-consistency.cjs",

35 "test:vision": "node --test bridge/test.js",

36 "test": "npm run test:installer && node scripts/check-consistency.cjs && node --test bridge/test.js && node preset/plugins/kix-guards.test.js && node preset/plugins/kix-commands.test.js && node preset/plugins/kix-cost.test.js && node preset/plugins/kix-route.test.js && node preset/plugins/kix-discipline.test.js && node preset/plugins/kix-orchestration.test.js && node preset/plugins/kix-focus.test.js"

37 },

38 "engines": {

39 "node": ">=20.16.0"

40 },

41 "kixparadigm": {

42 "presetId": "kixparadigm-en",

43 "presetDir": "preset",

44 "bridgeDir": "bridge"

45 },

46 "repository": {

47 "type": "git",

48 "url": "git+https://github.com/olicesx/kixparadigm.git"

49 },

50 "bugs": {

51 "url": "https://github.com/olicesx/kixparadigm/issues"

52 },

preset/plugins/kix-guards.jsView file

Lines 74-114javascript

74// 约束 sprint-9 之后的 hotfix 工作。

75// - 修复「预算兜底缺口 + 静默冷启动」：plan.md 增读 blast_radius.max_commits

76// （ps1 同源字段）；优先级 progress.commit_budget > plan.task_sizing.

77// derived_commit_budget > plan.blast_radius.max_commits > 冷启动 3，

78// 落冷启动必须 warn；deny 消息注明预算来源与 sprint 目录，移除误导性

79// 的「按 DAG 重算」措辞（任务 DAG 是规划文档，不做拦截）。

80//

81// 挂载方式：preset agent.cordis.yml 中一行：

82// - id: kix-guards

83// name: ./plugins/kix-guards.js

bin/kixparadigm-en.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm-en CLI — English edition, installs the kixparadigm-en preset

4require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm-en.jsView on unpkg · L3

5

preset/plugins/kix-guards.test.js#virtual:string-array:round1View file

167check("pwsh: cp 外部 → 控制平面 → deny（v8 目标命中）", await dispatch("pwsh", { command: `cp /tmp/settings.yaml ${HOME}/.dsh/settings.yaml` }), true) L168: check(`pwsh: curl -o ${HOME}/.dsh/settings.yaml URL → deny（v8 下载目标）`, await dispatch("pwsh", { command: `curl -o ${HOME}/.dsh/settings.yaml https://example.com/x` }), true) L169: check(`pwsh: curl -o /tmp/x URL → allow（v8 下载目标非控制平面）`, await dispatch("pwsh", { command: "curl -o /tmp/x https://example.com/x" }), false) ... L176: // ══ 4. run_code 代码体受限能力（v3 补 fs 直写）════════════════════════ L177: check("run_code: import(\"node:child_process\") → deny", await dispatch("run_code", { code: "const cp = await import(\"node:child_process\"); return 1" }), true) L178: check("run_code: fetch( 网络 → deny", await dispatch("run_code", { code: "const r = aw

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

preset/plugins/kix-guards.test.js#virtual:string-array:round1View on unpkg · L167

preset/skills/kixpower/tests/run-contract-regression.ps1View file

•path = [redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 56539 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

•path = [redacted]-contract-regression.ps1 kind = build_helper sizeBytes = 56539 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg